Agent skill · security · jeremylongshore
remofirst-security-basics
Review RemoFirst account, group, report, connector, and worker-data controls. Use when onboarding an operator, auditing access, or preparing a sensitive workflow. Trigger with "RemoFirst security", "review RemoFirst access", or "RemoFirst least privilege".
Why this skill is useful
Provides specific implementation patterns and error handling for RemoFirst's API that the AI wouldn't generate reliably on its own.
What it needs
Requires remofirst account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
RemoFirst Security and Privacy Baseline Overview Produce an evidence-based access and data-handling review for RemoFirst client operations. Focus on interactive account security, explicit group assignment, least data, controlled exports, connector credentials, and escalation. Prerequisites Named operator or service integration, business duty, countries, and teams. Current group membership and workflow inventory from an authorized source. Privacy, security, and business owners for exceptions. Current Contract Client users can enable authenticator-based two-factor authentication and receive a one-time recovery code that is replaced after use. A manager without an assigned group receives Superuser access by default. Groups constrain access by responsibility and team; direct-manager assignment is a separate workforce relationship. Reports may contain payroll, invoice, time-off, and worker information. Workday connector credentials originate in Workday; they are secrets. The reviewed public sources describe GDPR/DPA handling but not a general API key. Instructions 1. Inventory each identity, accountable owner, duty, group, team scope, last review, two-factor state, and termination/change trigger. 2. Treat no-group assignment as high risk because the documented default is Superuser. Assign the narrowest group through an authorized administrator. 3. Require two-factor authentication for client operators. Confirm recovery-code custody without collecting the code or any authenticator seed. 4. Separate workforce reporting lines from application permission groups; verify both independently when a manager changes role or team. 5. Inventory reports, CSV files, support attachments, and reconciliation artifacts. Minimize fields, redact identifiers, encrypt approved transfers, and define retention/deletion. 6. Keep Workday OAuth material and any provider-issued private credential only in an approved secret manager. Record owner and rotation evidence, not values. 7. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/remofirst-security-basics--1951d2